{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7774","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7774/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7774/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7774/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/7774","id":198281630,"number":7774,"title":"Fix pivoting of UDP sockets in scanners, recv/recvfrom for all pivoted UDP Rex sockets","user":{"login":"busterb","id":4108654,"avatar_url":"https://avatars.githubusercontent.com/u/4108654?v=3","gravatar_id":"","url":"https://api.github.com/users/busterb","html_url":"https://github.com/busterb","followers_url":"https://api.github.com/users/busterb/followers","following_url":"https://api.github.com/users/busterb/following{/other_user}","gists_url":"https://api.github.com/users/busterb/gists{/gist_id}","starred_url":"https://api.github.com/users/busterb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/busterb/subscriptions","organizations_url":"https://api.github.com/users/busterb/orgs","repos_url":"https://api.github.com/users/busterb/repos","events_url":"https://api.github.com/users/busterb/events{/privacy}","received_events_url":"https://api.github.com/users/busterb/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2017-01-01T21:03:33Z","updated_at":"2017-01-02T16:15:19Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/7774","html_url":"https://github.com/rapid7/metasploit-framework/pull/7774","diff_url":"https://github.com/rapid7/metasploit-framework/pull/7774.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/7774.patch"},"body":"While testing UDP pivoting on https://github.com/rapid7/mettle/pull/50 I found that modules calling recvfrom on a pivoted socket did not ever receive any data. Several overzealous rescues deep, I tracked it down to recvfrom_nonblock being changed in #6692 to call super (which is the ruby socket implementation), which does not accept *nil* for the flags parameter. So, any module that does not specify flags on recvfrom will cause a silent exception on that call, and fail to receive any data at all.\r\n\r\nAt the same time, I found that because the UDP scanner mixin does not bind the UDP socket on creation, the socket does not pivot. Setting CHOST/CPORT doesn't seem to help, and if it did, it's still strange to require it in order to route properly. This switches it to use bound sockets instead.\r\n\r\nThis also changs the behavior of the DIO handler to truncate datagrams rather than splitting them into smaller chunks, since it should be impossible to actually receive such a large UDP datagram, even with IP fragmentation (the actual limit here.) In other words, if a caller is sending such large datagrams, it is broken.\r\n\r\n## Verification\r\n\r\nList the steps needed to make sure this thing works\r\n\r\n- [ ] Start `msfconsole` and setup a windows meterpreter session (the only meterpreter with working UDP pivoting currently, unless https://github.com/rapid7/mettle/pull/50 is merged.\r\n- [ ] Run a UDP socket pivot-capable module, such as udp_probe, and enable a route so you can scan an active network with UDP services:\r\n\r\n```\r\nmsf > route add 192.168.1.0 255.255.255.0 1\r\nmsf > setg rhosts 192.168.1.0/24\r\nmsf > use auxiliary/scanner/discovery/udp_probe\r\nmsf > run\r\nmsf > use auxiliary/scanner/discovery/udp_sweep\r\nmsf > run\r\n```\r\n- [ ] **Verify** that the modules can detect UDP services through the pivot, and that it is actually generating traffic via the pivot.\r\n- [ ] Run the same modules without a pivot (don't add a route)\r\n- [ ] **Verify** that the modules detect the same services locally as well\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/269991802","html_url":"https://github.com/rapid7/metasploit-framework/pull/7774#issuecomment-269991802","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/7774","id":269991802,"user":{"login":"busterb","id":4108654,"avatar_url":"https://avatars.githubusercontent.com/u/4108654?v=3","gravatar_id":"","url":"https://api.github.com/users/busterb","html_url":"https://github.com/busterb","followers_url":"https://api.github.com/users/busterb/followers","following_url":"https://api.github.com/users/busterb/following{/other_user}","gists_url":"https://api.github.com/users/busterb/gists{/gist_id}","starred_url":"https://api.github.com/users/busterb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/busterb/subscriptions","organizations_url":"https://api.github.com/users/busterb/orgs","repos_url":"https://api.github.com/users/busterb/repos","events_url":"https://api.github.com/users/busterb/events{/privacy}","received_events_url":"https://api.github.com/users/busterb/received_events","type":"User","site_admin":false},"created_at":"2017-01-02T16:15:19Z","updated_at":"2017-01-02T16:15:19Z","body":"Started looking at the SNMP scanner, and became a little concerned about https://github.com/rapid7/metasploit-framework/pull/5497/commits/7c91aee7a80f5d9297f9778e866c32a88c30aa84 - I wonder what it is referring to. I don't think there is a problem on BSD systems binding a UDP socket, but will check."}}
{"actor":{"display_login":"busterb"}}